This article continues mini-series started with the post Introduction to Firewall Builder 4.0. This article is also available as a section in the “Firewall Builder Cookbook” chapter of Firewall Builder Users Guide 4.0.
Firewall Builder 4.0 is currently in beta testing phase. If you find it interesting after reading this post, please download and try it out. Source code archives, binary deb and rpm packages for popular Linux distributions and commercially distributed Windows and Mac OS X packages are available for download here.
In this post I demonstrate how Firewall Builder can be used to generate firewall configuration for a clustered web server with multiple virtual IP addresses. The firewall is running on each web server in the cluster. This example assumes the cluster is built with heartbeat using “old” style configuration files, but which high availability software is used to build the cluster is not really essential. I start with the setup that consists of two identical servers running Linux but in the end of the article I am going to demonstrate how this configuration can be converted to OpenBSD with CARP.
This entry is part 1 of 4 in the series Linux Firewall Cluster Configuration with Firewall Builder v4.:
Lets see how much effort it is going to take to convert this configuration to entirely different firewall platform – PF on OpenBSD. There are different ways to do this. I could make a copy of each member firewall (linux-test-1 and linux-test-2), set platform and host OS in the copy to PF and OpenBSD and then create new cluster object. This would be a sensible way because it preserves old objects which helps to roll back in case something does not work out. However, to make the explanation shorter, I am going to make the changes in place by modifying existing objects.
Now that all objects are ready and heartbeat is configured on the machines, we can move on and build some firewall rules. Since this is a cluster configuration, all rules go into the rule set objects that belong to the cluster rather than its member firewalls.
=> KDE 4 Review : Ars Technica reviews KDE 4.0 – KDE 4.0 was officially released last week after extensive development. The long-awaited 4.0 release ushers in a new era for the popular open-source desktop environment and adds many intriguing new features and technologies. Unfortunately, the release comes with almost as many new bugs as it does features, and there is much work to be done before it sparkles like the 3.5.x series.
=> Humor : Intelligent atheist white man seeks sweetie // Help me keep the shell people alive
=> Every aspect of computer users’ lives â€” from their heartbeat to a guilty smile — could be monitored and immediately analysed under the futuristic system detailed in Microsoftâ€™s patent application.
=> Asus Launches Windows Version of its Eee PC – Hackers no longer have to resort to their own devices to get Windows on Asus’s Eee PC.
=> Crispin Cowan, the Linux security expert behind StackGard, the Immunix Linux distro and AppArmor, has joined the Windows security team.
This article explains howto setup and running with the Linux Virtual Server and Linux-HA.org’s Heartbeat in 5 easy steps. You can construct a highly available Apache Web server cluster that spans multiple physical or virtual Linux servers with Linux Virtual Server (LVS) and Heartbeat v2:
Spreading a workload across multiple processors, coupled with various software recovery techniques, provides a highly available environment and enhances overall RAS (Reliability, Availability, and Serviceability) of the environment. Benefits include faster recovery from unplanned outages, as well as minimal effects of planned outages on the end user.
This article illustrates the robust Apache Web server stack with 6 Apache server nodes (though 3 nodes is sufficient for following the steps outlined here) as well as 3 Linux Virtual Server (LVS) directors. We used 6 Apache server nodes to drive higher workload throughputs during testing and thereby simulate larger deployments. The architecture presented here should scale to many more directors and backend Apache servers as your resources permit, but we haven’t tried anything larger ourselves. Figure 1 shows our implementation using the Linux Virtual Server and the linux-ha.org components.
However article failed to mention few things such as redundant networking, a cluster file system / shared storage and other stuff. Nevertheless tutorial is a good start for new Linux admin.
=> Set up a Web server cluster in 5 easy steps